File “Date modified” property are not updating while modifying a file without closing it.

  • Article

These days, we are monitoring this issue:
when one was developing a utility that monitors log files as they are updated.

On 2003, opening the log file folder in explorer, you can see the timestamp and files size change before your eyes each time the log is updated.

On 2008, "Last Modified" field on log files is not updated unless another
program attempts to open the file or the utility is stopped, even if F5 is pressed to
refresh the view.

Explorer gets is information from NTFS, by using a cmd prompt and "dir" we found that the NTFS metadata for the files is not updated until the handle to a file is closed.

Refreshing the information of a FOLDER is just going to go to the (memory resident) metadata cached by NTFS, but querying the file explicitly will force disk I/O to get the properties - this was a design change introduced in Vista to reduce unnecessary disk I/O to improve performance

There are some exceptions to this rule:
- in some, but not all, cases a simple "dir filename" is enough to refresh the metadata
- "special" folders may be treated differently, such as user profiles where we do not expect a large number of files and want to be able to rely on the file data presented
- kernel filter drivers may change the behaviour as by design they "add, remove or
change functionality of other drivers"

As the workaround is for any process to open and close a handle to the log files, a tool was written to do exactly that, plus get the file information, using the following APIs:
CreateFile
GetFileInformationByHandle
CloseHandle

Reference:
https://social.technet.microsoft.com/Forums/en-US/winservergen/Thread/2B8BACA2-9C1B-4D80-80ED-87A3D6B1336F

Comments

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Nice to see that Microsoft are on this one.
    Just because they haven't answered after 3 and a half years doesn't mean they don't care.

    Besides, not updating the modified time on a file is onviously very useful, as demonstrated by the screams of outrage on this thread.

    Coming soon: Microsoft optimises away all writes to files to reduce I/O overhead and increase performance.

  • Anonymous
    February 25, 2011
    The comment has been removed

  • Anonymous
    April 25, 2011
    We have the same problem.  Is there any solution to force Windows to report the correct modified timestamp even if it means more disk I/O?

  • Anonymous
    November 28, 2012
    I run this before my log parser kicks off.. it will do a directory listing of each file from today and that causes the file size to update.. not necessarily the modified date, though. for %i in (1 2 3 4) do for /f %G in ('"dir /b \web%iiislogu_ex%date:~12,2%%date:~4,2%%date:~7,2%.log /s"') do dir %G

  • Anonymous
    April 04, 2013
    any solution to this? we are seeing exact same issue.

  • Anonymous
    April 26, 2013
    Simple solution:

  1. Right click the "Date" button field on top where the wrong date is showing. (not the file but the header for that column)
  2. then choose "date modified" then right click again and uncheck "date" The "date" you are looking at is the for "date taken" or "created" change it to "date modified" and you should be good worked for me

  • Anonymous
    July 08, 2013
    Still looking for a solution to this issue - our backup software monitors the filesize of the target file and assumes if the size has not increased for 15 minutes that something has gone wrong, needless to say that with large files on a slow link our backups fail alot! Looking for a script I can run on the server on a 5 minute schedule that will update the metadata or perhaps a Registry key to modify this behavior globally on a server. Any help would be appreciated.

  • Anonymous
    November 21, 2013
    The comment has been removed

  • Anonymous
    May 29, 2014
    Pingback from Hives and Tools and Timestamps….. oh my! | Hats Off Security

  • Anonymous
    May 31, 2014
    Seems that this won't get fixed?

  • Anonymous
    June 12, 2014
    Experiencing exactly the same issue... even files that have definitely changed and re-named are showing completely wrong times. The issue seems to be intermittent.

    Microsoft.. Can you help? maybe if you spent more time fixing bugs than making up names like 'Microsoft Reduce Customer Effort Center' you wouldnt need to make the names up in the first place :-)

  • Anonymous
    June 20, 2014
    We're having the same problem where app logs in an Enterprise environment are not updating until opened or accessed. This information is sometimes critical for our systems.

  • Anonymous
    June 23, 2014
    Winblows as we often call window. Linux/Mac OS is much more reliable.

  • Anonymous
    June 23, 2014
    Winblows as we often call window. Linux/Mac OS is much more reliable.

  • Anonymous
    June 23, 2014
    you gotta be kidding me.. windows 7 and windows 8 is not for people who work on computers

  • Anonymous
    June 23, 2014
    you gotta be kidding me.. windows 7 and windows 8 is not for people who work on computers

  • Anonymous
    June 30, 2014
    What about Windows Server 2008R2? Same issue there.

  • Anonymous
    September 18, 2014
    hey guys same issue occurred in my system also, i find the solution , that is the not a software problem, that is hardware problem, kindly check motherboard CMOS battery slat.

  • Anonymous
    September 25, 2014
    I'm having the same problem. Why hasn't this been fixed???? This is ridiculous.

  • Anonymous
    October 20, 2014
    The comment has been removed

  • Anonymous
    November 26, 2014
    We need this fixed !!

  • Anonymous
    January 14, 2015
    By adding the "Date last saved" column seemed to work for me.

  • Anonymous
    January 19, 2015
    Why did M$ make this change to the OS behaviour?

    Don't come back with I/O improvements as that is bull$ and you know it.

    Are M$ to be trusted? Are there other reasons this has been done?

    Why do problems like this go on for YEARS? Are M$ to be trusted?

    I trust Arther Daley more. Oh dear. Linux beckons again.

  • Anonymous
    January 19, 2015
    They did it for us. We made them. Sorry about all your apps that monitor this property. Oh well. Now all your apps are belong to us!!!

  • Anonymous
    January 19, 2015
    The comment has been removed

  • Anonymous
    January 19, 2015
    The comment has been removed

  • Anonymous
    January 19, 2015
    hey kimi chen_
    er 14 Dec 2010 12:06 AM is over 4 years ago.
    did you forget? or did vga noodling work ok for you?

  • Anonymous
    January 19, 2015
    Well I'm at M$ so I forgot.

    Don't believe me? Check out all the other support issues that are unanswered for years and years!

    Happy VGA Noodling!

  • Anonymous
    January 19, 2015
    The comment has been removed

  • Anonymous
    January 20, 2015
    Shunmuga Prabu Kumar,

    You mean FIX!

    Worst Wishes,
    Big Brother (watching you, Shunmuga Prabu Kumar)

  • Anonymous
    January 20, 2015
    The comment has been removed

  • Anonymous
    January 20, 2015
    (me again kimi chen_)

    kimi, the first sentence of your article states, 'These days, we are monitoring this issue'.

    Any results or conclusions from your monitoring or are you still monitoring this issue? (These days?)

    kimi

  • Anonymous
    January 20, 2015
    We are monitoring this issue today still even!

    Did you try Shunmuga fix / workaround?
    kimi

  • Anonymous
    January 20, 2015
    Shunmuga Prabu Kumar may not be available for the foreseeable future.

    BB

  • Anonymous
    January 20, 2015
    Oh and Arther; it's actually 'Arthur' and not 'Arther' so watch it! OK?

    BB

  • Anonymous
    January 21, 2015
    Hey a message for 'EN ES AY';

    Hæc est hora vestra te ultro mihi tu prius dixeris!

    Oh and 'Arther' is fine by us.

  • Anonymous
    April 10, 2015
    Hey there,
    just here for supporting this because recently, I've discovered this bug on our 2k8 R2 machines (only on the physics, not VMs so far).

    Has anyone made a deeper analysis? Is it appearing on both, VM and physical?
    Really annoying if you gotta check logs everyday..

  • Anonymous
    April 10, 2015
    We're facing same issue. We tried to check if 'Date Last Saved' or 'Date' field captures the updated time stamp information but, it does not. Please share if anyone has any solution for this. Thanks.

  • Anonymous
    May 26, 2015

    Update the regfile

    [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem]
    "NtfsDisableLastAccessUpdate"=dword:00000001

  • Anonymous
    August 08, 2015
    I had the same problem with Word 2010 and Windows 7 - after editing a document the "Date Modified" did not update. However, in order to clearly identify which was the latest version of a document I decided to add the date to the File Name. As soon as i did this the "Date Modified" updated correctly. For some reason, editing the document itself did not trigger the Date Modified to update, but changing the File Name slightly did.

  • Anonymous
    August 31, 2015
    Here, we tried the "CreateFile/ GetFileInformationByHandle/ CloseHandle" approach and this "NtfsDisableLastAccessUpdate" key, but none worked.

    We're "touching" the directory, by creating and deleting a dummy file.

  • Anonymous
    October 18, 2015
    Thank you Paul. It worked for me!